New User Role on Scalingo : collaborate together without exposing your data

To collaborate effectively without risking the stability or security of your applications and data, we’re introducing a new role designed to give your technical teams more freedom while safeguarding sensitive settings and customer data.

Better Tools for Better Collaboration

At Scalingo, simplicity has always been one of our core values: including when it comes to how teams collaborate on application development. As your team grows or your project begins handling sensitive data (such as HDS-compliant health information), it’s essential that each collaborator has access rights tailored to their role.

Upto now, inviting someone to collaborate on an application granted them almost the same level of access as the application owner, including deployment, configuration, log access, and the ability to manage other users, secrets, and data.

For many teams, this setup has proven effective, with the combination of repository-level isolation and deployment platform security offering a level of control that fits their needs. The Collaborator role made it easy to onboard trusted contributors quickly, giving them full access to the application environment and its data.

In more structured organizations, many of you have told us that this level of access can prove unsuitable, or simply too broad, for certain types of users.

A Role Designed for Contributors

Our new Limited Collaborator role is primarily intended for developers, contributors, or external contractors who need to work on your applications without being able to change configuration settings, deploy unvalidated code, or access databases.

It’s particularly well suited if:

You work with external developers or freelancers
You want to limit data access to a smaller, trusted group within your company
You manage junior team members or support staff
You’re preparing your project for stricter security or compliance requirements

Limited Collaborators can work on an application by accessing its configuration in read-only mode, monitoring deployments, re-deploying the default branch, and viewing recent logs and metrics. However, they cannot access environment variables, change configuration, interact with databases, or manage other collaborators.

Check the documentation to see the full list of permissions associated with each role.

When to use it?

This role is designed to be the default option whenever you invite a new collaborator to your applications.

This role ensures a minimal level of initial access, which can be adjusted at any time - either during the invitation process or later on- based on the user’s role and level of responsibility.

Some privileges require special attention and should only be granted to trusted, qualified, and appropriately authorized users.

Start by Reviewing Access for Your Current Collaborators

The introduction of this new role is the perfect opportunity to review access rights across your team and ensure that each collaborator’s role still aligns with their current responsibilities. In fact, France’s national cybersecurity agency (ANSSI) recommends conducting regular reviews of user permissions as part of secure IT system administration.

Some access levels may need to be reduced if they’re too broad, and you may also identify outdated accounts or permissions that should be revoked.

For more advanced use cases, the Scalingo API allows you to integrate access verification into your internal processes.

Our Recommendations for Securing Access to Your Applications

We’ve also published a team-based access management guide that brings together our best practices for making the most of Scalingo’s existing access control and security features. This guide will help you configure your applications and choose the right roles based on your team’s structure or your organization’s setup.

From startups to product teams to multi-project agencies, these best practices can help every kind of organization find the right balance between collaboration and security.

A New Step Toward More Granular Access Management

This update is the result of user research driven by a need many of you have shared with us: the ability to delegate tasks and streamline workflows, without unnecessarily exposing your data.

This new role was designed to integrate naturally with your existing workflows and team practices. We hope it will help make collaboration on your apps smoother, while keeping your data secure.

This is just the first step in a broader effort to give you more granular and flexible control over access management. It lays the groundwork for the future of IAM at Scalingo, something we are actively shaping with your feedback.